Your venue's own staff portal
A staff portal for the whole team: open your venue's private link on a device you've paired, and each staff member signs in with their own PIN — no shared password, no staff email accounts. They see live bookings, the floor plan and the day's tools, but only the parts their role allows.
On Plus and above — from £39/month.
No per-user pricing — a plan's staff seats are included in its monthly price.
Pair a device, hand out PINs.
No accounts to create, no passwords to remember — the whole thing is built for a busy front-of-house.
- 1
Pair your devices
Open your venue's private portal link on each tablet or phone the team will use, sign in once as the owner or an admin, and give the device a name — "Front-of-house iPad". Only paired devices ever show the PIN screen.
- 2
Add your team
Add each person by name and pick their role. ResoFlow generates them a strong PIN — you choose the length, four to eight digits — never an obvious one like 123456. If a staff member later picks an easy-to-guess PIN, the portal warns them first.
- 3
They sign in with a PIN
One PIN each. Staff tap it in on the keypad — it submits itself on the last digit — and the portal knows exactly who they are. No picking a name from a list, no shared login for the whole team.
- 4
Sessions look after themselves
Idle devices sign out automatically after a period you control — from five minutes to four hours, tuned per role — and every staff session ends within twelve hours regardless, so nobody stays signed in overnight.
Everyone sees exactly what they should.
Four built-in roles
Owner, Admin, Manager and Host cover the usual split out of the box: admins run everything except billing, managers run the operation, hosts get bookings and front-of-house without any settings at all.
Custom roles & per-person tweaks
Add up to five roles of your own — a Bar role, a Duty Manager — and fine-tune any individual on top: grant one host a little more, or hold one permission back, without inventing a whole new role.
Hidden, not locked
The portal menu only shows what that person can open. A host never sees marketing, analytics or staff management — not greyed out, simply not there. Fewer buttons, fewer questions.
Built for the iPad everyone touches.
Front-of-house devices get passed around all night. The portal is designed for that, not merely tolerant of it.
Paired devices, revocable in a tap
Every approved device is listed by name in your settings. A tablet goes missing? Revoke it — the moment you do, it drops back to needing owner set-up, PIN screen gone. You can also rotate the portal link itself, with a grace window you choose.
Every action has a name
Cancellations, edits, refunds — the activity log records who did what under the staff member's own name, because each PIN is one person. You can also see every signed-in session and end any of them remotely.
Their own little corner
Each staff member picks their own light or dark look and can change their own PIN from their portal profile. When they sign out, the device goes back to exactly how the owner left it.
A manager's PIN, when money moves.
Refunds and cancellations shouldn't wait for the owner — or be open to everyone. PIN approvals are the middle ground.
One PIN, one action
A staff member with the right permission types their PIN to approve a single action — a deposit refund, a booking cancellation, a gift card adjustment. The approval covers that one action and expires after two minutes.
Checked against their role, every time
A PIN can never approve more than its owner could do themselves — the permission is re-checked on the server for every approval. Owners can add an approve-only PIN of their own: it authorises actions, but can never sign in.
On the record — and never for personal data
Every approval lands in the activity log with the approver's name. And actions touching guests' personal data are deliberately excluded from PIN approval — those always require a real password sign-in.
The honest limits.
Staff sign-in is PIN-only
Staff don't get email-and-password logins — the PIN is the account. Owners and admins still sign in with their own credentials (there's a link on the same screen), and anything owner-level, like billing or plan changes, stays outside the portal entirely.
A device must be paired first
The portal link on its own gets nobody in — an owner or admin has to sign in once on each new device before the PIN screen will appear. That's deliberate friction: it keeps lost phones out, but it does mean setting up a new device takes an owner or admin.
Staff seats follow your plan
Every plan caps how many staff you can add, and on the free plan it's just you. If you're hiring faster than your plan allows, it's a plan change, not an add-on — the seat counts are on the pricing page's comparison table.
Lockouts are strict by design
Ten wrong PINs locks that device for an hour, and only an owner can clear it early from the dashboard. Protective, but real: a determined toddler at the host stand could park a tablet for a while.
And the staff sign-in screen always says "Powered by ResoFlow" — the white-label option covers your guest-facing pages, not the team's portal.